Claude Code now sends sandboxed Bash through normal permission checks, and no-prompt runs need an explicit switch

Sandboxed Bash commands no longer run without prompts by default; they enter the normal permission flow like other commands, and users must explicitly set sandbox.autoAllowBashIfSandboxed to true to restore prompt-free running. Previously sandboxed Bash commands were treated as a class that could be allowed directly, taking a different permission path from commands outside the sandbox. The changelog lists this as a Changed item and adds that environments where managed settings turn the sandbox on must also set the switch in their highest-ranking managed source to keep commands running without prompts.

The tightening also reaches repository trust and plugin loading: read-only git commands ask first in a repository that is not the project's or one you trusted, and plugin MCP bundles unpack under the plugins directory instead of a cache folder inside the plugin's folder. Previously read-only git commands did not ask in those repositories, and plugin MCP bundles unpacked into .mcpb-cache inside the plugin's folder. The changelog records both as Changed entries and says naming the directory with --add-dir rather than the additionalDirectories setting lets such git commands run without prompts; read-only plugin folders can therefore load.

This item describes only Claude Code's default permission handling for Bash commands when the sandbox is on, and the asking behavior of read-only git commands in repositories that are not the project's or trusted; it applies to developers and administrators using the tool and its settings files.

The changelog says environments where managed settings turn the sandbox on must set the switch in their highest-ranking managed source, or commands still enter the prompt flow; for scheduled tasks that relied on an always-allow rule, it says they can now wait for the user.